Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2023, 14:58

General

  • Target

    27de9936630ad1b2ab1520e1e78775c1.exe

  • Size

    432KB

  • MD5

    27de9936630ad1b2ab1520e1e78775c1

  • SHA1

    1b0b992185c796a06e37dad95ecc4e56af8033fe

  • SHA256

    cc42f53d486da30f747ed6412188e020adf369280b17d481476f38cee1ab9786

  • SHA512

    82c8ee8d508628ceeecd8c752de17c88b7a71a72bf1bf1a51b60ef1bf71bf775d75177691ed810f43c77e539887bda2707658345b3906a283d017fcd99530203

  • SSDEEP

    6144:KOy+bnr+Wp0yN90QEbdaQtk+d/mIkB9zSRWA+jgckaZZq541/r0GMJ36apxX86Bs:yMrCy90ZVv/mDBtyaZU5ydvapJna0K

Malware Config

Extracted

Family

redline

Botnet

maga

C2

77.91.124.54:19071

Attributes
  • auth_value

    9dd7a0be219be9b6228dc9b4e112b812

Signatures

  • Detects Healer an antivirus disabler dropper 4 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27de9936630ad1b2ab1520e1e78775c1.exe
    "C:\Users\Admin\AppData\Local\Temp\27de9936630ad1b2ab1520e1e78775c1.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6417252.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6417252.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4640174.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4640174.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2464
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5810998.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5810998.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6417252.exe

    Filesize

    206KB

    MD5

    a8224d7d4da04b76b22f808e79dbceb6

    SHA1

    6dd0339606b4dc87f796736b2ee221a0e6491601

    SHA256

    42ab2527416733255b0cd7f19c3244a4e9345cb9c33b1edc942d8584b5b5ac83

    SHA512

    1d50633a168ed4992fd812b72211ea28c1be5139f90915e09cafe8d9accead3c342bbe36d35ced63cae8fc52d3b70462ffec17e5705eb8f4c37981099d3fb226

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6417252.exe

    Filesize

    206KB

    MD5

    a8224d7d4da04b76b22f808e79dbceb6

    SHA1

    6dd0339606b4dc87f796736b2ee221a0e6491601

    SHA256

    42ab2527416733255b0cd7f19c3244a4e9345cb9c33b1edc942d8584b5b5ac83

    SHA512

    1d50633a168ed4992fd812b72211ea28c1be5139f90915e09cafe8d9accead3c342bbe36d35ced63cae8fc52d3b70462ffec17e5705eb8f4c37981099d3fb226

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4640174.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4640174.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5810998.exe

    Filesize

    174KB

    MD5

    c589a2892deb8511cb773c751b1f3e87

    SHA1

    bec401a3553e249a7538a5e9a9122deed71b61ce

    SHA256

    a7172f7f88ad5dd9d4d7287b181f6c18c2bede457b7f54c1a188289340987399

    SHA512

    888262be66ec6e6be572c0825173245e410e97c8306c4ea408d0478a925975f62cf08d342edaf6a8bbbcbcba0cc067a65df14764dacc4a81650a50817a24cabe

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5810998.exe

    Filesize

    174KB

    MD5

    c589a2892deb8511cb773c751b1f3e87

    SHA1

    bec401a3553e249a7538a5e9a9122deed71b61ce

    SHA256

    a7172f7f88ad5dd9d4d7287b181f6c18c2bede457b7f54c1a188289340987399

    SHA512

    888262be66ec6e6be572c0825173245e410e97c8306c4ea408d0478a925975f62cf08d342edaf6a8bbbcbcba0cc067a65df14764dacc4a81650a50817a24cabe

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z6417252.exe

    Filesize

    206KB

    MD5

    a8224d7d4da04b76b22f808e79dbceb6

    SHA1

    6dd0339606b4dc87f796736b2ee221a0e6491601

    SHA256

    42ab2527416733255b0cd7f19c3244a4e9345cb9c33b1edc942d8584b5b5ac83

    SHA512

    1d50633a168ed4992fd812b72211ea28c1be5139f90915e09cafe8d9accead3c342bbe36d35ced63cae8fc52d3b70462ffec17e5705eb8f4c37981099d3fb226

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z6417252.exe

    Filesize

    206KB

    MD5

    a8224d7d4da04b76b22f808e79dbceb6

    SHA1

    6dd0339606b4dc87f796736b2ee221a0e6491601

    SHA256

    42ab2527416733255b0cd7f19c3244a4e9345cb9c33b1edc942d8584b5b5ac83

    SHA512

    1d50633a168ed4992fd812b72211ea28c1be5139f90915e09cafe8d9accead3c342bbe36d35ced63cae8fc52d3b70462ffec17e5705eb8f4c37981099d3fb226

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\r4640174.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\s5810998.exe

    Filesize

    174KB

    MD5

    c589a2892deb8511cb773c751b1f3e87

    SHA1

    bec401a3553e249a7538a5e9a9122deed71b61ce

    SHA256

    a7172f7f88ad5dd9d4d7287b181f6c18c2bede457b7f54c1a188289340987399

    SHA512

    888262be66ec6e6be572c0825173245e410e97c8306c4ea408d0478a925975f62cf08d342edaf6a8bbbcbcba0cc067a65df14764dacc4a81650a50817a24cabe

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\s5810998.exe

    Filesize

    174KB

    MD5

    c589a2892deb8511cb773c751b1f3e87

    SHA1

    bec401a3553e249a7538a5e9a9122deed71b61ce

    SHA256

    a7172f7f88ad5dd9d4d7287b181f6c18c2bede457b7f54c1a188289340987399

    SHA512

    888262be66ec6e6be572c0825173245e410e97c8306c4ea408d0478a925975f62cf08d342edaf6a8bbbcbcba0cc067a65df14764dacc4a81650a50817a24cabe

  • memory/2464-74-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2464-75-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2464-73-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2464-72-0x0000000000970000-0x000000000097A000-memory.dmp

    Filesize

    40KB

  • memory/2928-82-0x00000000013D0000-0x0000000001400000-memory.dmp

    Filesize

    192KB

  • memory/2928-83-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB